chore(deps): update dependency vite-plus to v0.2.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
vite-plus (source)	0.1.20 → 0.2.1

---

Release Notes

voidzero-dev/vite-plus (vite-plus)

v0.2.1: vite-plus v0.2.1

Compare Source

Restores support for older Node.js (back to 20.19.0) and makes vp exec --fail-if-no-match fail correctly on unmatched filters.

Fixes & Enhancements

• Stop blocking older Node.js versions: v0.2.0 blocked commands when the resolved Node.js version fell outside the declared range. This reverts that enforcement and widens engines.node to ^20.19.0 || ^22.18.0 || >=24.11.0, matching Vite's own ^20.19.0 floor, so older Node that works in practice (e.g. Node 20 in rolldown CI) is no longer rejected (#​1865), by @​fengmk2
• vp exec --fail-if-no-match: exit non-zero when one or more --filter expressions match no workspace packages. Strict mode previously only warned and returned success, so typoed filters looked successful in CI even though no package command ran (#​1859), by @​jong-kyung

Bundled Versions

Tool	Version	Source
vite	8.0.16	f94df87
rolldown	1.1.1	d7f919c
tsdown	0.22.3	npm
vitest	4.1.9	npm
oxlint	1.70.0	npm
oxlint-tsgolint	0.23.0	npm
oxfmt	0.55.0	npm

Upgrade

vp upgrade

Upgrading from 0.1.x to 0.2.1 Prompt

You are upgrading a project that uses Vite+ (the `vp` CLI) from v0.1.x to v0.2.1.

v0.2.1 has one breaking change vs v0.1.x: it consumes upstream Vitest directly. The `@voidzero-dev/vite-plus-test` wrapper package is removed. `vitest` and the base browser runtime (`@vitest/browser`, `@vitest/browser-preview`) now come in transitively through `vite-plus`. The opt-in browser providers (`@vitest/browser-playwright`, `@vitest/browser-webdriverio`) are NOT shipped by `vite-plus`: any project that runs browser-mode tests must install the provider it uses itself.

Do not run `vp migrate` for this upgrade; it is not reliable enough yet. Make the changes yourself by editing the project's files, then verify by running the tools.

How to run vp: if a global `vp` is available, use it. Otherwise this project only ships the local CLI from the `vite-plus` package, so run vp as the project-local binary (for example via the package manager's exec: pnpm exec, npx, yarn, or bunx). After any install, re-resolve vp so you always run the version currently in the project.

Do the following:

1. Set the `vite-plus` dependency to the exact version `0.2.1` and reinstall, so the new toolchain is installed and the lockfile moves off 0.1.x. In a monorepo, do this for every workspace package that depends on `vite-plus` (a shared `catalog:` entry covers them all at once). Changing the spec to `0.2.1` is what moves the lockfile off the old resolution; a reinstall that leaves the spec unchanged would keep the old version.

2. Remove the `@voidzero-dev/vite-plus-test` wrapper from the project. Search everywhere it could appear: package.json, the lockfile, any workspace or catalog config (such as pnpm-workspace.yaml or .yarnrc.yml), and the source files. Then classify the project and apply the matching case. Note these are not exclusive: a browser-mode project is also handled by case C in addition to removing the wrapper config.

   First, determine the project's Vitest usage:
   - BROWSER MODE: the project runs Vitest in the browser. It does if a config or test file imports a real browser provider (`vite-plus/test/browser-playwright` or `vite-plus/test/browser-webdriverio`, or the pre-upgrade raw forms `@vitest/browser-playwright` / `@vitest/browser-webdriverio`), or sets `test.browser.enabled`. This needs extra deps regardless of anything below; see case C.
   - DIRECT vitest usage: a source or test file imports directly from `vitest` or `@vitest/...`, or a `@vitest/*` package is listed in its dependencies (for example a coverage provider). Plain imports from `vite-plus/test` and `vite-plus/test/*` do NOT count as direct usage; a `vite-plus/test/browser-*` provider import is a browser-mode signal (case C), not direct usage.

   Case A - node-mode only (no direct vitest usage, no browser mode; the common case): remove the vitest configuration entirely. In package.json, delete the `vitest` entry from `dependencies` / `devDependencies` in whatever form it takes (a `@voidzero-dev/vite-plus-test` alias, a `catalog:` reference, or a plain version). Also remove the `vitest` entry from every dependency-resolution mechanism in the project: both `overrides` and `resolutions`, pnpm `overrides`/`catalog` (in package.json or pnpm-workspace.yaml), and any catalog entry. If `vitest` appears in more than one of these, remove all of them. Do not add a pinned `vitest`; it arrives transitively through `vite-plus` and the node-mode test command works without it.

   Case B - direct vitest usage: pin upstream vitest to the version bundled with vite-plus (4.1.9 for v0.2.1), and upgrade every vitest ecosystem package the project depends on so the whole tree resolves to a single vitest. Set each `@vitest/*` package the project lists (for example `@vitest/coverage-v8`, `@vitest/ui`, `@vitest/browser`) to that same version (4.1.9), since those are pinned to an exact vitest version. Also update any other vitest integration package (such as `vitest-browser-*`) to a release compatible with that vitest version. Leaving an ecosystem package on an older version pulls in a second copy of vitest, which Vitest rejects at runtime.

   Case C - browser mode (in addition to removing the wrapper config): you MUST add two deps to the workspace package that runs the browser tests (not the repo root, unless that is where the tests live), both pinned to the bundled vitest version so the tree still resolves to a single vitest:
     - The browser provider the project actually uses: `@vitest/browser-playwright@4.1.9` and/or `@vitest/browser-webdriverio@4.1.9`. Without it, config load fails with `Cannot find package '@​vitest/browser-playwright'` from `vite-plus/test/browser-playwright`. Make sure its framework peer is present too (`playwright` for Playwright, `webdriverio` for WebdriverIO); the project usually already has it.
     - A direct `vitest@4.1.9`. This is the one case where you DO add a pinned vitest, and it contradicts the "never add vitest" rule that holds for node mode. Reason: under pnpm's isolated node_modules, `vitest` is only a transitive dep of `vite-plus`, so the browser-tester Vite server (rooted at the consumer project) cannot resolve `vitest/internal/browser` or the `vitest > ...` optimizeDeps entries. The symptom is `Failed to resolve import "vitest/internal/browser"` followed by `Failed to connect to the browser session ... within the timeout` and a `no tests` run. vite-plus 0.2.1 ships a `vite-plus:vitest-resolver` plugin meant to rescue this, but it does not reach the separate `@vitest/browser` orchestrator server, so a direct `vitest@4.1.9` (matching the bundled version, single copy preserved) is required. (If a future vite-plus fixes the resolver to cover the browser-tester server, this direct `vitest` may become unnecessary; re-check.)

   In all cases, also delete any dependency-resolution config that existed only to accommodate the wrapper or the old vitest, for example pnpm `peerDependencyRules` entries (`allowedVersions` / `ignoreMissing`) referencing `vitest`, `@vitest/*`, or `@voidzero-dev/vite-plus-test`, and the equivalent peer-tweak config in other package managers (such as yarn `packageExtensions`). Leave rules that are unrelated to vitest or the wrapper untouched.

3. Keep the `vite` -> Vite+ core override (it is still required) and set it to the matching exact version: map `vite` to `npm:@​voidzero-dev/vite-plus-core@0.2.1` in whatever override, resolution, or catalog form the project already uses. `@voidzero-dev/vite-plus-core` is released in lockstep with `vite-plus`.

4. Leave imports from `vite-plus/test` (and `vite-plus/test/*`, including `vite-plus/test/browser-playwright`) unchanged; that is the stable public API. Only if a file imports directly from `@voidzero-dev/vite-plus-test`, repoint it to `vite-plus/test`. Leave `declare module 'vitest'` / `declare module '@​vitest/browser*'` type augmentations pointing at the upstream module (they must target the upstream identity to merge).

5. Reinstall so the lockfile reflects your edits, then verify:
   - No reference to `@voidzero-dev/vite-plus-test` remains anywhere outside node_modules (source, configs, lockfile).
   - The dependency tree resolves to a single `vitest` version (4.1.9) with no duplicate copies. Note that one `vitest@4.1.9:` entry in the lockfile `packages:` section plus one `vitest@4.1.9(...)` key in `snapshots:` is still a single version, not a duplicate.
   - The project's tests pass with Vitest's native banner; for browser mode, confirm the suite actually runs in the browser (you get passing test files, not `no tests` or a session timeout). Browser tests also need the browser binary installed (e.g. `npx playwright install chromium`).
   - The Vite+ check workflow passes (exit 0). A pre-existing lint/format warning in a file you did not touch is not a failure; report it but do not fix it.

   Troubleshooting: if you hit `vitest/internal/browser` resolution errors, or see duplicate `@vitest/browser` / `vite-plus` peer-variant directories under `node_modules/.pnpm` after several sequential installs across this dependency-graph change, do a clean reinstall (remove `node_modules` in the root and all workspaces, remove the Vite optimize caches `node_modules/.vite`, then reinstall) to collapse the stale variants before concluding it is a code problem.

Constraints:
- Do not run `vp migrate`.
- Do not bypass git hooks. If a pre-existing failure blocks you, report it rather than forcing through.
- Make the smallest set of edits that reaches the end state above; do not reformat unrelated files. (For browser mode, the added `vitest` + provider pins ARE part of that minimal end state.)
- When done, give me a short summary: old vs new `vite-plus` version, the files you changed, the test/check results, and call out explicitly any dependency you added beyond the wrapper removal (especially a direct `vitest`) with the reason.

Full Changelog: voidzero-dev/vite-plus@v0.2.0...v0.2.1

Published Packages

• @voidzero-dev/vite-plus-core@0.2.1
• vite-plus@0.2.1

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

v0.2.0: vite-plus v0.2.0

Compare Source

Vite+ now consumes upstream Vitest directly (no wrapper), raises the minimum supported Node.js version to 22.18.0, and ships corepack and devEngines support.

Highlights

• vp test now runs upstream Vitest directly (breaking): Vite+ used to ship @voidzero-dev/vite-plus-test, a rebundled copy of Vitest that lagged upstream releases. That package is removed; vp test now runs the real upstream vitest, which is installed automatically as a dependency of vite-plus (you no longer add vitest or @vitest/* yourself, and vite still resolves to @voidzero-dev/vite-plus-core via package-manager overrides). Your import ... from 'vite-plus/test' code keeps working unchanged and vp migrate updates existing projects (#​1588), by @​Brooooooklyn
• Minimum supported Node.js version raised to ^22.18.0 || >=24.11.0 (breaking): Node 20 reached end-of-life and the bundled tsdown already required ^22.18.0, so the published engines range now matches what vp pack can actually deliver; vp exec / vp run / vp dlx reject projects resolving an older Node with the existing incompatibility error (#​1813), by @​fengmk2
• Corepack now works under Vite+: corepack now set up by default, so corepack enable and the pnpm/yarn launchers just work, even on Node 25+ which no longer ships it. (#​1808), by @​fengmk2
• devEngines support for runtime and package-manager selection: Vite+ reads devEngines.runtime (ranked above engines.node) and devEngines.packageManager; auto-pin and vp migrate write devEngines.packageManager, vp env pin / unpin target devEngines.runtime, and vp env doctor reports conflicts instead of silently resolving them (#​1760), by @​fengmk2

Features

• vp pm approve-builds: forward to npm's new approve-scripts / deny-scripts (npm >= 11.16.0) instead of the previous no-op, matching pnpm approve-builds / bun pm trust; mixed approve+deny is rejected with actionable guidance and npm's advisory-only caveat is surfaced (#​1733), by @​fengmk2
• vp create: support local monorepo templates declared in create.templates in vite.config.ts; vp create vite:generator scaffolds a Bingo generator and auto-registers it in the picker, replacing the old package.json-keyword inference (#​1777), by @​fengmk2
• vp create: detect direct dependencies whose build scripts the package manager gated (e.g. native builds like better-sqlite3) and act on them; prompt to approve each (default off) interactively, point at vp pm approve-builds non-interactively, or build them with --approve-builds (#​1828), by @​fengmk2
• vp config: add --no-hooks and --no-agent opt-outs to skip git-hook installation and coding-agent instruction updates (#​1842), by @​leno23
• vp list -g: sort the global package list output so entries appear in a stable order (#​1748), by @​liangmiQwQ
• Upgrade upstream dependencies: rolldown 1.0.3 -> 1.1.1, tsdown 0.22.1 -> 0.22.3, oxlint 1.67.0 -> 1.70.0, oxfmt 0.52.0 -> 0.55.0, vitest 4.1.8 -> 4.1.9, and the oxc toolchain 0.133.0 -> 0.136.0 (#​1749, #​1767, #​1812, #​1834, #​1855), by @​voidzero-guard[bot]

Fixes & Enhancements

• Security: resolve open Rust Dependabot advisories by bumping transitive openssl 0.10.76 -> 0.10.80 (openssl-sys 0.9.112 -> 0.9.116), fixing five high-severity rust-openssl issues (buffer overflows in key derivation, AES key wrap, and digest finalization; an unchecked PSK/cookie trampoline length leaking adjacent memory; and OCSP-responder undefined behavior: GHSA-pqf5-4pqq-29f5, GHSA-8c75-8mhr-p7r9, GHSA-ghm9-cr32-g9qj, GHSA-hppc-g8h3-xhp3, GHSA-xp3w-r5p5-63rr), and drop the unmaintained, unsound libyml (GHSA-gfxp-f68g-8x78, high) by removing dead serde_yml code (#​1742), by @​fengmk2
• Security (docs site): update mermaid 11.13.0 -> 11.15.0 to fix improper classDef sanitization in state diagrams that allowed HTML injection (CVE-2026-41149 / GHSA-ghcm-xqfw-q4vr, medium severity; <script> tags are stripped so it does not reach XSS) (#​1745), by @​renovate[bot]
• vp check --fix / vp staged: create/migrate now wrap inline Vite plugins: [...] arrays with lazyPlugins(...) so plugin factories aren't eagerly executed (and don't hang on open handles) during lint/format/check config loading (#​1752), by @​jong-kyung
• vp migrate: complete pending migration work for projects that already have vite-plus installed (scripts, imports, tsconfig types, ESLint/Prettier, legacy hooks, package-manager settings) instead of treating vite-plus as migration-complete; fully migrated projects stay idempotent (#​1821), by @​jong-kyung
• vp create / vp migrate: detect shorthand fmt, / lint, config keys so a duplicate inline block is no longer injected (#​1843), by @​fengmk2
• IDE oxlint/oxfmt wrappers: set VP_COMMAND so lazyPlugins() skips framework plugins during LSP config reads, preventing a stray .svelte-kit (and similar) directory at the monorepo root (#​1764), by @​jong-kyung
• vp lint / vp run -r lint on Windows: keep the absolute tsgolint path for workspace lint runs instead of downgrading it to a wrong cwd-relative path (#​1758), by @​semimikoh
• oxlint wrapper: set the tsgolint path so type-aware lint resolves it (#​1811), by @​jong-kyung
• vp install -g: use a unique backup directory and treat stale-backup cleanup as best-effort so a locked Windows binary no longer fails an otherwise successful reinstall (#​1753), by @​fengmk2
• vp install -g: remove stale managed binary shims when a reinstalled package drops a bin from its package.json#bin (#​1765), by @​liangmiQwQ
• vp create --git: surface git's actual stdout/stderr when the initial commit fails instead of always blaming user.name / user.email (#​1819), by @​fengmk2
• vp create vite:generator: reject --git / --no-git, since adding a generator to an existing monorepo does not initialize git (#​1788), by @​jong-kyung
• Global CLI: harden find_system_tool against a self-exec loop (skip the running executable's own bin directory) and fix two vite_global_cli tests that could hang (#​1820), by @​fengmk2
• CLI help: unify alias display (#​1832), show supported run options (#​1797), show --fail-if-no-match in exec help (#​1798), add the implode documentation link (#​1796), and handle nested-command typo help (#​1803), by @​jong-kyung

Docs

• Document vp create opt-out options (#​1790), by @​jong-kyung
• Document vp upgrade options (#​1847), by @​jong-kyung
• Align the config overview with the sidebar (#​1846), by @​jong-kyung
• Sync the documented command lists with the help output (#​1850), by @​jong-kyung
• Clarify lazy plugin side effects (#​1841), by @​leno23
• Add JongKyung's X profile (#​1844) and update Christoph's X profile (#​1845) on the team page, by @​jong-kyung

Refactor

• Remove the CLI tips system; the shortcuts it printed on vp install are already covered by the help system and added unnecessary complexity (#​1799), by @​cpojer

Chore

• Re-enable Renovate dependency updates with a targeted ignore-list (#​1744), by @​fengmk2
• Keep generated NAPI bindings during upgrade-deps (#​1759), by @​fengmk2
• Remove the vite_glob dependency from vite-plus (#​1763), by @​wan9chi
• Keep sync-remote from churning pnpm-workspace.yaml (dedupe minimumReleaseAgeExclude, preserve comments) (#​1787), by @​fengmk2
• Make unix just test runnable (#​1755), by @​situ2001
• CI: reuse just lint and just test as the single source of truth (#​1809), pin cargo-zigbuild to a git rev to fix the aarch64-musl link failure (#​1815), and keep upgrade-deps green when rolldown bumps oxc (#​1833), by @​fengmk2
• Update Rust to nightly-2026-06-10 (#​1725), typos to v1.47.1 / v1.47.2 (#​1772, #​1775), GitHub Actions (#​1778, #​1829), and npm packages (#​1779), by @​renovate[bot]
• Bump oxc-project/setup-node to v1.3.1 (#​1792), by @​Boshen
• Refresh trusted stack stats on the docs homepage (#​1786, #​1837), by @​voidzero-guard[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.16	f94df87
rolldown	1.1.1	d7f919c
tsdown	0.22.3	npm
vitest	4.1.9	npm
oxlint	1.70.0	npm
oxlint-tsgolint	0.23.0	npm
oxfmt	0.55.0	npm

New Contributors

Welcome to our new contributor @​situ2001! 🎉

Full Changelog: voidzero-dev/vite-plus@v0.1.24...v0.2.0

Upgrading from 0.1.x to 0.2.x Prompt

See Upgrading from 0.1.x to 0.2.1 Prompt

Published Packages

• @voidzero-dev/vite-plus-core@0.2.0
• vite-plus@0.2.0

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

v0.1.24: vite-plus v0.1.24

Compare Source

A new vp pm stage publishing workflow, hardened installs and upgrades, a Node-version mismatch reinstall prompt, and the bundled vite/vitest/tsdown stack moves forward.

Features

• vp pm stage: a new vp pm subcommand exposing npm's staged-publishing workflow (upload a build to a staging area without 2FA, then approve or reject it from a trusted device); it maps to pnpm stage / npm stage / yarn npm ... --staged per package manager, with an npm fallback for yarn Classic and bun (#​1715), by @​fengmk2
• vp: prompt to reinstall when up-to-date global packages were built against a different Node.js than the active one (defaults to no); adds --reinstall-node-mismatch and --ignore-node-mismatch, and skips the prompt in CI (#​1666), by @​liangmiQwQ
• vp format: add format as a visible alias of vp fmt, so the common slip vp format resolves correctly and vp format --init / --migrate apply the same vite.config.ts wiring as vp fmt (#​1727), by @​semimikoh

Fixes & Enhancements

• vp install / Node runtime download: HTTP retries now wrap the whole body stream, hash verification, and archive extraction (not just the request headers), so truncated or corrupt downloads of package managers and Node are re-fetched instead of failing on the first attempt (#​1719), by @​fengmk2
• vp upgrade --force on Windows: install into a fresh directory before repointing current, so the forced reinstall no longer fails trying to overwrite the running vp.exe (#​1714), by @​fengmk2
• vp install -g: install global packages directly into their final prefix instead of a temp dir that gets moved, so packages whose postinstall scripts bake in absolute or relative temp paths still resolve their bins; a failed package in a multi-package install no longer removes the shims of the ones that already succeeded (#​1698), by @​liangmiQwQ
• vp why: remove the -g / --global flag, which delegated to the package manager's global mode and ignored Vite+-managed global packages; vp why stays project-scoped while vp outdated -g keeps using the managed global flow (#​1720), by @​liangmiQwQ
• Windows installer: remove the existing current link via PowerShell (detecting junctions, symlinks, and stale directories) instead of cmd /c rmdir, which could fail with "The directory is not empty" (#​1726), by @​TheAlexLichter
• vp create: skip editor-config detection and package-local editor settings by default when creating a project inside an existing monorepo; --editor <name> stays an explicit opt-in and --no-editor an opt-out (#​1729), by @​jong-kyung
• vp create vite:monorepo (pnpm): keep the aliased vite/vitest in the website app's package.json so the workspace overrides.vite: catalog: has a direct consumer and vp why vite resolves to @voidzero-dev/vite-plus-core; npm/yarn/bun still drop the dead-weight keys (#​1728), by @​fengmk2
• vp pack: rewrite direct createRequire(...)("picomatch") calls in bundled tsdown output to the local bundled CJS entry, so packing no longer depends on an undeclared runtime picomatch under pnpm hoist: false (#​1732), by @​fengmk2
• vp migrate: resolve a catalog: husky pin from the workspace catalog (pnpm-workspace.yaml, .yarnrc.yml, or package.json catalogs) during the git-hooks preflight, so a compatible catalog-pinned husky no longer triggers a false "could not determine husky version" warning and skips hook setup (#​1710), by @​fengmk2

Docs

• Add a Copy Prompt button to the docs site that copies an AI-friendly getting-started prompt (intro, llms-full.txt pointer, install commands, and core vp commands) for handing straight to a coding agent (#​1706), by @​fengmk2
• Update troubleshooting.md: vite.config.ts related issues are resolved by updating oxlint and oxfmt (#​1708), by @​leaysgur
• Clarify the product and repository documentation locations and the new Run guide/config paths in AGENTS.md (#​1707), by @​leaysgur

Chore

• vp install: reduce retained vp versions from 5 to 3 across the installer, vp upgrade, and the shell/PowerShell bootstrap scripts (active and previous versions stay protected for rollback); document the 3-version retention and vp upgrade --rollback (#​1716), by @​fengmk2
• Exclude the snap-tests directory from Vitest config discovery so the VS Code Vitest extension stops generating a stray .vitest-plugin-loaded file (#​1723), by @​liangmiQwQ
• Refresh trusted stack stats on the docs homepage (#​1734), by @​voidzero-guard[bot]
• Update @​wan9chi's GitHub handle (formerly branchseer) (#​1705), by @​wan9chi
• Update GitHub Actions (#​1724, #​1730), by @​renovate[bot]
• Upgrade upstream dependencies: vite 8.0.14 → 8.0.16, vitest 4.1.7 → 4.1.8, tsdown 0.22.0 → 0.22.1, @vitejs/devtools 0.2.0 → 0.3.1 (#​1713, #​1735, #​1737), by @​voidzero-guard[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.16	f94df87
rolldown	1.0.3	a287faa
tsdown	0.22.1	npm
vitest	4.1.8	npm
oxlint	1.67.0	npm
oxlint-tsgolint	0.23.0	npm
oxfmt	0.52.0	npm

New Contributors

Welcome to our new contributor @​semimikoh! 🎉

Full Changelog: voidzero-dev/vite-plus@v0.1.23...v0.1.24

Published Packages

• @voidzero-dev/vite-plus-core@0.1.24
• @voidzero-dev/vite-plus-test@0.1.24
• vite-plus@0.1.24

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Upgrade:

vp upgrade

v0.1.23: vite-plus v0.1.23

Compare Source

Enterprise-ready HTTP (proxy + custom CA), task command shorthands in vite.config.ts, a smoother vp create/vp migrate, and the oxc/vite/rolldown bundled stack moves forward.

Highlights

• Proxy and custom-CA aware HTTP: a new process-wide vite_shared::shared_http_client() honors HTTPS_PROXY / HTTP_PROXY / NO_PROXY, picks up macOS System Settings / Windows registry proxies, loads custom CAs from SSL_CERT_FILE and NODE_EXTRA_CA_CERTS, and exposes a VP_INSECURE_TLS diagnostic switch; makes vp work through Socket Firewall Free and other TLS-intercepting proxies (#​1686), by @​fengmk2
• Task command shorthands: run.tasks entries in vite.config.ts now accept a bare string ("build": "cmd") or array ("build": ["cmd1", "cmd2"]) instead of always requiring { command: ... }; arrays reuse the existing && planning path so cache, dependsOn, and task options stay consistent (vite-task#391), by @​jong-kyung
• Managed vp outdated -g: routes through Vite+'s managed global package metadata instead of delegating to the underlying npm outdated -g store, so all installed global packages are reported consistently (#​1659), by @​liangmiQwQ

Features

• vp pm approve-builds: new unified subcommand that mirrors pnpm approve-builds one-to-one, adapts to bun pm trust, and warns-and-noops on npm/yarn (#​1662), by @​fengmk2
• vp create: opt-in GitHub Copilot setup; selecting --agent copilot now generates a .github/workflows/copilot-setup-steps.yml so the Copilot Coding Agent can set up Vite+ and run vp in the new project out of the box (#​1683), by @​jong-kyung
• vp migrate: prompt to remove baseUrl from tsconfig.json before applying type-aware lint defaults (runs @andrewbranch/ts5to6 --fixBaseUrl . under the hood; auto-applied in non-interactive mode) (#​1692), by @​TheAlexLichter
• Respect packageManager in package-manager shims (npm/npx, pnpm/pnpx, yarn/yarnpkg, bun/bunx); add non-mutating packageManager resolution metadata for vp env current and vp env which (#​1654), by @​fengmk2
• vite-task: --filter no-match now exits 0 by default; add --fail-if-no-match to opt back in (vite-task#393), by @​kazupon

Fixes & Enhancements

• vp create: keep generated .vscode/settings.json trackable when the VS Code editor option is selected (avoid templates' .vscode/* .gitignore masking it) (#​1700), by @​jong-kyung
• vp create vite:monorepo: normalize sub-package vite-plus to catalog: even when only vite-plus (not vite/vitest/...) is present, and drop the vite/vitest aliases generated by the upstream library template (#​1697), by @​fengmk2
• vp add/install -g <path>: resolve the real package name from package.json instead of using the path string, so local-path installs don't create broken directories (#​1685), by @​liangmiQwQ
• vp test --coverage and other direct built-in commands now expose the workspace's package.json#packageManager to child processes so tools like Vitest coverage can spawn the configured PM (#​1696), by @​jong-kyung
• vp migrate: clean up the whole ESLint ecosystem (plugins, configs, parser/resolver, type-utils) rather than just eslint; skip the migration entirely when @nuxt/eslint is detected (#​1682), by @​fengmk2
• vp create: write fmt.configPath (not configPath) for Zed oxfmt settings to match the official Zed OXC extension layout (#​1687), by @​chungweileong94
• vp migrate: parse tsconfig.json as JSONC so files with comments don't break baseUrl detection/removal (#​1688), by @​TheAlexLichter
• vp env setup: Unix env shims now point at the active vp executable instead of always assuming VP_HOME/current/bin/vp, so Homebrew-style installs work (#​1631), by @​leohara
• vp outdated -g / vp why -g: don't require a local package.json; global commands run regardless of cwd (#​1622), by @​liangmiQwQ
• vp create: default the "Initialize a git repository?" prompt to yes (#​1650), by @​fengmk2
• vp hooks: include the managed Node bin in PATH so ./node_modules/.bin/vp can find node from a VS Code commit on macOS (#​1647), by @​TheAlexLichter
• vpx on Windows now invokes the package's .cmd shim instead of the Unix binary (#​1652), by @​tobynguyen27
• vite-task: bump cache database schema to version 13 (forces a one-time rebuild of the local task cache) (vite-task#402), by @​branchseer
• Bump vite-task to d02b257 and 5833b374; also bumps the repo's Rust nightly toolchain to nightly-2026-05-24 and ships the regenerated run config types and docs for the new task command shorthand (#​1689, #​1695), by @​branchseer

Refactor

• Replace VP_SHELL_NU/VP_SHELL_PWSH with a single VP_SHELL override; add explicit shell parsing for bash, zsh, fish, nu, pwsh, and cmd, and harden auto-detection against nested shells (#​1658), by @​nekomoyi
• vite-task: replace allocator-api2 with bumpalo collections (vite-task#400), by @​branchseer
• vite-task: drop the unused and_item_index field from ExecutionItemDisplay (vite-task#394), by @​branchseer

Docs

• Add the root AGENTS.md as the primary AI-agent guide for the vite-plus repository; convert CLAUDE.md into a compatibility pointer (#​1670), by @​jong-kyung
• Align the agent validation table to match AGENTS.md (#​1673), by @​jong-kyung
• Update the task output caching guide so the documented behavior matches what vite-task actually does (#​1639), by @​ericclemmons
• Correct the bundled-source location in packages/core/BUNDLING.md (#​1660), by @​shulaoda

Chore

• Clarify --help text for vp env default/pin/use/exec with Examples: blocks (#​1664), by @​Boshen
• Refresh trusted stack stats on the docs homepage (#​1680), by @​voidzero-guard[bot]
• Drop the standalone pnpm --filter @​rolldown/pluginutils build step now that @rolldown/pluginutils is published from its own package (#​1655), by @​shulaoda
• Preserve single-quote style when sync-remote rewrites pnpm-workspace.yaml (#​1672), by @​lyzno1
• Enable vite_pm_cli lib tests by removing a stale test = false flag (#​1661), by @​shulaoda
• CI: switch macOS runners back to namespace-profile-mac-default (#​1701), by @​fengmk2
• CI: fix release-day flakes in the upgrade test and snap test when the dev package.json version equals npm latest (#​1645), by @​fengmk2
• CI: replace zizmor and cargo-deny workflows with oxc-project/security-action (#​1635), by @​Boshen
• CI: warm-up monorepo cache test under npm (#​1649), by @​fengmk2
• CI: attach per-target vp binary archives (.tar.gz/.zip) to GitHub Releases alongside the existing vp-setup-*.exe installers (#​1665), by @​Boshen
• CI: declare Playwright via repo.json in ecosystem tests and bump consumers to >=1.60 to dodge the Node 24.16.0 hang (#​1668), by @​fengmk2
• Update GitHub Actions (#​1640, #​1675, #​1678, #​1679, #​1691), by @​renovate[bot]
• Upgrade upstream dependencies: vite 8.0.11 → 8.0.14, rolldown 1.0.0 → 1.0.3, vitest 4.1.6 → 4.1.7, oxlint 1.63.0 → 1.67.0, oxfmt 0.48.0 → 0.52.0, oxlint-tsgolint 0.22.1 → 0.23.0, @oxc-project/* and oxc Rust crates 0.129.0 → 0.133.0 (#​1646, #​1653, #​1693, #​1699), by @​voidzero-guard[bot]

Bundled Versions

Tool	Version	Source
vite	8.0.14	c917f1e
rolldown	1.0.3	a287faa
tsdown	0.22.0	npm
vitest	4.1.7	npm
oxlint	1.67.0	npm
oxlint-tsgolint	0.23.0	npm
oxfmt	0.52.0	npm

New Contributors

Welcome to all new contributors! 🎉

@​ericclemmons, @​tobynguyen27, @​shulaoda, @​leohara, @​chungweileong94

Full Changelog: voidzero-dev/vite-plus@v0.1.22...v0.1.23

Published Packages

• @voidzero-dev/vite-plus-core@0.1.23
• @voidzero-dev/vite-plus-test@0.1.23
• vite-plus@0.1.23

Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

Upgrade:

vp upgrade

v0.1.22: vite-plus v0.1.22

Compare Source

A critical Vitest browser-mode security fix, parallel vp add -g installs, a built-in oxlint rule to prefer vite-plus imports, and a new --git switch for vp create.

Highlights

• Security: bundled vitest bumped to 4.1.6 to address GHSA-2h32-95rg-cppp (Critical, CVSS 9.6), an XSS to RCE chain via the otelCarrier query parameter in Vitest browser mode (#​1633)
• Parallel global install: vp add/install/update -g now installs packages concurrently with a progress bar and a --concurrency flag (default 5) (#​1597)
• Prefer vite-plus imports: new bundled oxlint rule rewrites vite/vitest imports to vite-plus, enabled by default in generated and migrated lint configs (#​1408)
• Git init on scaffold: vp create learns --git/--no-git (interactive prompt; auto-commits "Initial commit from Vite+") (#​1484)

Features

• Spawn npm for global installation in parallel with a progress bar and a --concurrency option (#​1597), by @​liangmiQwQ
• Add bundled oxlint rule to prefer vite-plus imports over vite/vitest (#​1408), by @​Han5991
• vp create: initialize a git repository and create an initial commit on scaffold (#​1484), by @​ryohidaka
• vp create: rename underscore-prefixed files (_gitignore, _npmrc, _yarnrc.yml) to dotfiles for @org/create bundled templates (#​1574), by @​jong-kyung
• Add VP_PR_VERSION env var to install unreleased PR builds via pkg.pr.new (#​1578), by @​fengmk2

Fixes & Enhancements

• Skip merging standalone .oxfmtrc/.oxlintrc config when the fmt:/lint: key is already declared in vite.config.ts (fixes duplicate-block regression in vp create fate) (#​1601), by @​fengmk2
• Suppress the VITE+ - The Unified Toolchain for the Web banner for vp lint --lsp, vp fmt --lsp, and vp fmt --stdin-filepath so stdout stays a pure LSP / formatter stream (#​1619), by @​fengmk2
• vp create: detect output directory wh

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Error		Jun 25, 2026 6:47am
npmx.dev	Error		Jun 25, 2026 6:47am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
npmx-lunaria	Ignored		Jun 25, 2026 6:47am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite-plus@​0.2.1

View full report

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[github-actions]

⚠️ Dependency Count

This PR adds 15 new dependencies (2348 → 2363), which exceeds the threshold of 15.

📊 Dependency Size Changes

Warning

This PR adds 22.4 MB of new dependencies, which exceeds the threshold of 200 kB.

📦 Package	📏 Size
@oxlint/binding-linux-x64-gnu@1.61.0 → @oxlint/binding-linux-x64-gnu@1.70.0	7 MB
@voidzero-dev/vite-plus-linux-x64-gnu@0.1.20 → @voidzero-dev/vite-plus-linux-x64-gnu@0.2.1	5.3 MB
@voidzero-dev/vite-plus-core@0.2.1	5.1 MB
@vitest/browser@4.1.9	1.8 MB
oxlint@1.61.0 → oxlint@1.70.0	842.5 kB
@oxlint-tsgolint/linux-x64@0.22.0 → @oxlint-tsgolint/linux-x64@0.23.0	572.2 kB
vite-plus@0.1.20 → vite-plus@0.2.1	460.2 kB
@oxfmt/binding-linux-x64-gnu@0.46.0 → @oxfmt/binding-linux-x64-gnu@0.55.0	-274.4 kB
oxfmt@0.46.0 → oxfmt@0.55.0	239.2 kB
@oxc-project/runtime@0.136.0	235.2 kB
@oxlint/plugins@1.68.0	195.5 kB
@vitest/runner@4.1.9	193.9 kB
@vitest/mocker@4.1.9	187.4 kB
@vitest/utils@4.1.9	168.2 kB
chai@6.2.2	146.6 kB
@vitest/expect@4.1.9	106.8 kB
@vitest/snapshot@4.1.9	59.3 kB
@vitest/pretty-format@4.1.9	49.8 kB
@oxc-project/types@0.136.0	44.5 kB
@vitest/spy@4.1.9	37.4 kB
@blazediff/core@1.9.1	21.6 kB
@vitest/browser-preview@4.1.9	12.9 kB
oxlint-tsgolint@0.22.0 → oxlint-tsgolint@0.23.0	0 B

Total size change: 22.4 MB